ISO 27001:2022 - The 5 Major Changes

ISO 27001:2022: five major changes that still matter in 2026

ISO/IEC 27001:2022 is no longer a future migration project. In November 2026, organisations should be operating their information security management system, or ISMS, against this edition rather than preparing for a deadline that has passed.

The transition from ISO/IEC 27001:2013 ended on 31 October 2025, as specified in IAF MD 26. A certificate still referring only to the 2013 edition should trigger a check with the certification body, not an assumption that it remains valid under the transition arrangements.

The practical question has changed: do your controls, records and management decisions demonstrate that the updated requirements actually work? These five changes provide a useful framework for answering it.

1. Annex A reorganises controls around four themes

The reference set moves from 114 controls in the previous edition to 93, grouped into four themes:

• Organisational controls: 37.
• People controls: 8.
• Physical controls: 14.
• Technological controls: 34.

Fewer control entries do not mean less security work. Existing controls have been merged or updated, and the relationships between policies, operational procedures and technical safeguards still need to be understood.

Start with a mapping between the former references and the current controls. For each entry, identify its owner, implementation status and supporting evidence. Where several old controls now sit under one reference, check that the combined implementation still covers the relevant activities.

The Statement of Applicability, or SoA, should explain the necessary controls, why they are included and whether they are implemented. It must also justify exclusions from Annex A. Copying a generic list of 93 controls does not establish applicability for your organisation.

Your risk treatment determines which controls are necessary. Annex A is a reference set to check that necessary controls have not been overlooked, not a requirement to deploy every control identically everywhere. Additional controls may be needed for your risks or contractual commitments.

2. Eleven new controls address contemporary operating environments

The eleven new controls cover threat intelligence, cloud services security, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.

Their value lies in operational decisions rather than policy titles. For example:

• Threat intelligence: identify relevant sources, assess applicability and record actions when a threat affects your environment.
• Cloud services: clarify shared responsibilities, approval arrangements and exit considerations before a service becomes business-critical.
• Information deletion: establish how data is removed when retention needs end, including responsibilities involving suppliers.
• Secure coding: connect development practices to review, testing and remediation evidence.

Data masking is not synonymous with anonymisation. Masking can conceal or transform values without necessarily making individuals unidentifiable. Describe the technique and purpose accurately rather than claiming that masked personal data automatically falls outside GDPR.

For each applicable control, ask three questions: who owns it, what activity implements it, and what evidence shows it works? This turns the new references into maintainable practices rather than an annual audit exercise.

3. Context and interested-party requirements become more explicit

Context analysis and leadership were already part of the previous edition. They should not be presented as entirely new obligations introduced in 2022.

One specific clarification is clause 4.2(c): determine which requirements of interested parties will be addressed through the ISMS. A list of customers, regulators and suppliers is therefore not enough. Connect relevant requirements to the processes and decisions that address them.

A customer may require controlled access to project information. A supplier dependency may create availability concerns. Translate these inputs into risk assessment, contractual arrangements or operational controls, with an accountable owner.

There is also a later update to consider. ISO/IEC 27001:2022/Amd 1:2024 introduces climate-action changes. Organisations must determine whether climate change is a relevant issue; the amendment also notes that interested parties can have climate-related requirements.

For an ISMS, assess relevance to information security, such as dependencies on facilities, power or communications. This does not automatically require a separate environmental programme. Record a reasoned conclusion and revisit it when the operating context changes.

4. Changes to the ISMS must be planned

Clause 6.3 explicitly requires changes to the ISMS to be carried out in a planned manner. This concerns changes to the management system, not simply technical change tickets.

Consider a business moving a critical service to a cloud provider. Beyond approving the migration, assess whether the ISMS scope, risk treatment, supplier requirements, responsibilities and documentation need updating.

A practical change record can capture:

• The reason for the change and its intended outcome.
• Affected processes, assets and interested parties.
• Risks, dependencies and required resources.
• Responsibilities, implementation arrangements and follow-up checks.

Connect this work to your risk analysis. An approved project should not leave behind an outdated risk assessment or a SoA describing controls that no longer match operations.

5. Process ownership and management oversight need usable evidence

The 2022 edition retains the core management-system approach: set objectives, operate processes, evaluate results and improve. Leadership is not a new feature, but its effectiveness must be visible beyond a signed policy.

Define how processes interact. A supplier assessment can lead to a risk decision, an action plan, a contractual requirement and a monitoring activity. Assign ownership at those handovers so that unresolved issues do not disappear between teams.

Choose indicators that support decisions. Reporting an overdue access review is useful when management can see the affected scope, associated risk, responsible person and recovery action. A dashboard without follow-up does not demonstrate effective oversight.

Use management reviews to assess results and resource needs, then retain decisions and follow-up evidence. Internal audits should test the management system and its implementation, not merely confirm that document headings match the standard.

A practical review sequence for November 2026

Use this sequence whether you completed the transition early or inherited an existing ISMS:

1. Confirm the certificate edition, scope and current status with the certification body.
2. Review the control mapping and SoA against actual operations.
3. Sample evidence for newly introduced and materially changed controls.
4. Reassess context, interested-party requirements and climate relevance.
5. Check that significant ISMS changes were planned and followed through.
6. Feed remaining gaps into internal audit, corrective actions and management review.

Keep records connected rather than collecting isolated screenshots. Domyno combines a SaaS platform with a dedicated human expert; agents prepare work and a human validates it. Its controls and compliance module supports a shared control library, evidence, action plans and the SoA.

The objective is a working ISO 27001 management system, not a one-time reference-number update. To discuss how to organise that work, request a demo.